Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am search to find a program, or a way to block ips that make port scan on the server.

The goal is to hide some ports like remote desktop on a different port. So some are search the port with port scanning to locate this port and start the attacks.

The server is running Windows Server 2008 64-bit, and its a remote administrate server with iis and mail services mostly.

In previus versions of Windows Servers (eg on 2003) I use the comodo firewall that have this ability, but on 2008 comodo just not work and I am searching for something else but still did not found any.

Can you please give me some ideas/solutions ?
Thank you in advanced.

share|improve this question
    
edited my answer below. –  gravyface Feb 25 '11 at 13:33
1  
Blocking port scanning is security by obscurity - which is no security at all. I wouldn't waste my time worry about port scans, just lock down the firewall and secure the few services that are allowed through. –  Chris S Feb 25 '11 at 14:15
    
@Chris I like what you say, but I need some more reasons, can you please give me an example why I do not waste my time on that block ? –  Aristos Feb 25 '11 at 20:10
    
today's 'hackers' aren't after well protected machines/networks. They're botnets, looking to expand their network. They're looking for easily exploitable low-hanging fruit to use as a platform to launch other attacks. If you change the port a service normally operates on, the botnets will never find it. If on the other hand a clandestine organization is bent on hacking your server, they'd quickly realize after trying X ports, an IP gets blocked, so they'd use hundreds of ports (botnet?) to try all the ports. If your IPS blocked all IPs, it'd be an effective DDoS. –  Chris S Feb 25 '11 at 20:38

3 Answers 3

up vote 3 down vote accepted

I'd really want a hardware firewall in front of this server if it's exposed to the Internet.

Also, use IP restrictions in whatever firewall you end up using to only permit RDP access from certain hosts/IP ranges. This will eliminate your typical, random port scanning.

EDIT

If you can't restrict access by IP address/range, have a look at Snort, an Intrusion Detection/Prevention System, that's free/open source and runs on Windows*.

*Have not used it on Windows 2008 64-bit, but can confirm it does work on win32.

share|improve this answer
    
Well this is a good option on a full control system by me, but I am on a shered network leasing a computer and I can not have this options - nether can ask for a common firewall that shere this with the other servers. I need to protect my server with my procedure/software –  Aristos Feb 24 '11 at 13:28
    
If you control the Windows 2008 Firewall, you can put in IP restrictions. –  gravyface Feb 24 '11 at 17:12
    
+1 for the snort and thank you. - I will check it today –  Aristos Feb 25 '11 at 20:12

Windows Server 2008 have a (good) firewall. Switch it on.

http://technet.microsoft.com/en-us/library/cc772589(WS.10).aspx

share|improve this answer
    
Is ON anyway, but is not what I ask for. I ask for blocking port scanning. –  Aristos Feb 24 '11 at 15:44

This is a dawdle with Linux or BSD. Upgrade to a real operating system or put a good quality scriptable firewall in front of it?

The NT firewall is scriptable - using netsh advfirewall.

So you'd just need to write a server daemon to listen on several ports either side of the one you're wanting to protect then add a blocking rule for that IP address. You'll also need to maintain a list of what IP's you've blocked and when so you can remove the rules later and prevetn the table getting too large.

But a much better solution is to use whitelisting to only allow specific clients - or a VPN.

share|improve this answer
    
Well I do not know Linux or BSD and my programs and pages are all on windows. I just have to live with that. The whitelist is an option that I can not do because we login from non static ips. –  Aristos Feb 24 '11 at 15:47
    
Then use a VPN or tunnel via SSL with client authentication –  symcbean Feb 27 '11 at 15:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.